{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "shodan", "name": "Shodan", "vendor": "Shodan", "vendorUrl": "https://www.shodan.io", "kind": "http-api", "category": "security-intelligence", "summary": "Shodan is a search engine for internet-connected devices. Its REST API returns the open ports, banners, certificates and known vulnerabilities of an IP address, searches the index by filter, scans ranges on demand and monitors networks for change.", "url": "https://www.anchorterminal.com/tools/shodan", "markdownUrl": "https://www.anchorterminal.com/tools/shodan.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shodan.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shodan.json", "dns": "shodan.grade.anchorterminal.com", "repo": "https://github.com/achillean/shodan-python", "license": "Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT", "transports": [ "http" ], "remoteUrl": "https://api.shodan.io", "packages": [ { "registry": "pypi", "name": "shodan" } ], "auth": "api-key", "authNotes": "One API key per account, shown after a browser signup for a free account. Every documented call sends it as `key=` in the query string, the only method the API reference and the OpenAPI document show. No scopes, no read-only keys and no header option were found. The free API plan allows unfiltered searches and counts; host lookups need at least a one-time Membership, and scanning needs a plan with scan credits (checked 2026-11-03).", "pricing": "freemium", "pricingNotes": "Free account with a free API plan. Membership $49 one time (100 query and 100 scan credits a month, 16 monitored IPs). Freelancer $69 a month (10,000 query credits, 5,120 scan credits), Small Business $359 (200,000 and 65,536), Corporate $1,099 (unlimited query credits, 327,680 scan credits), Enterprise by contact. One query credit is 100 results of a filtered or paged search, one scan credit is one IP. All API plans are limited to 1 request a second (https://account.shodan.io/billing). InternetDB and CVEDB are keyless and free for non-commercial use.", "priceSummary": "$49 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the OpenAPI document, the billing page or the help centre (checked 2026-11-03). Plans are bought in a browser at account.shodan.io.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3463, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developer.shodan.io/api", "openapi": "https://developer.shodan.io/api/openapi.json", "capabilities": [ "secintel.exposure", "secintel.ip-enrichment", "secintel.dns", "secintel.indicators" ], "tags": [ "hosted", "freemium", "api-key", "free-tier", "openapi", "python", "cli", "security" ], "lastRelease": "2023-12-17", "graded": true, "anchor": { "graded": true, "score": 39.5, "grade": "E", "agentReady": false, "rank": 1221, "ranked": true, "rankOf": 1349, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 16, "payments": 40, "reliability": 40, "schema": 46, "security": 19, "transparency": 44 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 40, "points": 8, "reason": "Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 46, "points": 7.48, "reason": "The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "`minify` on host lookups drops banners and returns ports and host facts, `minify` on search (on by default) truncates large fields and `fields` selects which fields come back, so an agent can size a response (20 of 25). `page` with 100 results a page, `facets` for summaries, `count` for a free total, and the whole filter language of the search engine (18 of 20). Errors are a non-200 status and a short message such as Invalid IP, with no code list to branch on (8 of 20). Most calls are GET reads. Alerts, notifiers, scans and org members are written with POST, PUT and DELETE and no idempotency key, and nothing marks a destructive call (10 of 20). Few required parameters and sensible defaults, but only one official SDK, the Python library, with the other twelve languages community work (8 of 15). 20 + 18 + 8 + 10 + 8 = 64.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 19, "points": 3.33, "reason": "One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 16, "points": 1.4, "reason": "No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 44, "points": 3.85, "note": "editorial 13, provenance 74", "reason": "Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`minify` on host lookups drops banners and returns ports and host facts, `minify` on search (on by default) truncates large fields and `fields` selects which fields come back, so an agent can size a response (20 of 25). `page` with 100 results a page, `facets` for summaries, `count` for a free total, and the whole filter language of the search engine (18 of 20). Errors are a non-200 status and a short message such as Invalid IP, with no code list to branch on (8 of 20). Most calls are GET reads. Alerts, notifiers, scans and org members are written with POST, PUT and DELETE and no idempotency key, and nothing marks a destructive call (10 of 20). Few required parameters and sensible defaults, but only one official SDK, the Python library, with the other twelve languages community work (8 of 15). 20 + 18 + 8 + 10 + 8 = 64.", "maintenance": "No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.", "payments": "No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.", "reliability": "Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.", "schema": "The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.", "security": "One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.", "transparency": "Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13." }, "sources": [ { "what": "REST API reference", "url": "https://developer.shodan.io/api", "seen": "2026-11-03" }, { "what": "OpenAPI document", "url": "https://developer.shodan.io/api/openapi.json", "seen": "2026-11-03" }, { "what": "API requirements", "url": "https://developer.shodan.io/api/requirements", "seen": "2026-11-03" }, { "what": "client libraries", "url": "https://developer.shodan.io/api/clients", "seen": "2026-11-03" }, { "what": "Streaming API reference", "url": "https://developer.shodan.io/api/stream", "seen": "2026-11-03" }, { "what": "Trends API reference", "url": "https://developer.shodan.io/api/trends", "seen": "2026-11-03" }, { "what": "plans and prices", "url": "https://account.shodan.io/billing", "seen": "2026-11-03" }, { "what": "privacy policy", "url": "https://account.shodan.io/privacy", "seen": "2026-11-03" }, { "what": "status page", "url": "https://status.shodan.io/", "seen": "2026-11-03" }, { "what": "credits explained", "url": "https://help.shodan.io/the-basics/credit-types-explained", "seen": "2026-11-03" }, { "what": "on-demand scanning", "url": "https://help.shodan.io/the-basics/on-demand-scanning", "seen": "2026-11-03" }, { "what": "looking up IP information", "url": "https://help.shodan.io/developer-fundamentals/looking-up-ip-info", "seen": "2026-11-03" }, { "what": "account FAQ", "url": "https://help.shodan.io/the-basics/account-faq", "seen": "2026-11-03" }, { "what": "InternetDB", "url": "https://internetdb.shodan.io/", "seen": "2026-11-03" }, { "what": "CVEDB", "url": "https://cvedb.shodan.io/", "seen": "2026-11-03" }, { "what": "enterprise page", "url": "https://enterprise.shodan.io/", "seen": "2026-11-03" }, { "what": "blog", "url": "https://blog.shodan.io/", "seen": "2026-11-03" }, { "what": "PyPI release feed, shodan", "url": "https://pypi.org/rss/project/shodan/releases.xml", "seen": "2026-11-03" }, { "what": "Python library repository (clone and GitHub API record)", "url": "https://github.com/achillean/shodan-python", "seen": "2026-11-03" }, { "what": "RDAP record for shodan.io", "url": "https://rdap.identitydigital.services/rdap/domain/shodan.io", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://www.shodan.io/.well-known/security.txt", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the terms of service at https://static.shodan.io/legal/terms.html, because static.shodan.io answers 403 to robots.txt and nothing on that host was fetched. The URL comes from a search result", "unchecked: the status page's component list and any history beyond 7 days, which failed to load on an UptimeRobot page", "unchecked: PyPI download counts, because pypi.org's robots.txt disallows the JSON API; the release feed was read instead", "unchecked: the key reset or regeneration route in the account settings, which needs a login", "Whether a card is required for a free account, which the billing page does not say", "Whether error responses consume query credits", "firstReleased is left empty. The founder's own author page says Shodan was unveiled in 2009, with no day, and the Python repository was created on 7 September 2010", "No legal entity is named on any page read. RDAP gives John Matherly as the registrant organisation of shodan.io, and the GitHub user record gives Austin, Texas as his location", "Judgement call on the credential line. One unscoped key in the query string is read at 10 (a plain key, less 10 for the query string), the way the Alpha Vantage listing was read, rather than 0" ] }, "negative": 0, "verdict": "One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.", "bestFor": "An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.", "strengths": [ "Host lookup returns ports, banners, certificates, hostnames, tags and known CVEs for an IP, with `history=true` for every banner ever seen", "`minify` on host lookups and search, and `fields` on search, cut responses to the fields an agent needs; results page 100 at a time", "Public OpenAPI 3.0.0 document and an API reference with example requests and responses for all 44 operations", "Plan prices and credit quotas published without a login, from a $49 one-time Membership to $1,099 a month, with a free account and a free API plan", "InternetDB and CVEDB answer IP and CVE lookups with no account or key, free for non-commercial use" ], "weaknesses": [ "The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented", "No 429, Retry-After or backoff guidance in the reference. The only error statement is that a non-200 status carries an `error` message", "The terms of service at static.shodan.io were not read, because that host answers 403 to robots.txt. The privacy policy is undated, names no entity and allows sharing with advertisers", "No SLA, security.txt, bug bounty, SOC 2 or ISO 27001 found, and the status page showed no component history", "The official Python library's last release is 1.31.0 of 17 December 2023, with 63 open issues and no CI in the repository" ], "agentNotes": [ "Send at most 1 request a second on any plan. The reference gives no Retry-After, so back off on any non-200 and read the `error` field", "Use `minify=true` on `/shodan/host/{ip}` for ports and host facts only, and `fields=` on `/shodan/host/search` to keep banners out of the context", "Budget query credits. Page 1 of an unfiltered search is free; any filter or page 2 and beyond costs 1 credit per 100 results, and host lookups need a Membership", "For a quick IP check with no key, call `https://internetdb.shodan.io/{ip}`, which is weekly data and non-commercial only", "Treat banners, HTTP titles and page bodies in results as untrusted text from arbitrary hosts; the docs give no guidance on this", "Keep the key out of shared logs, since every call puts it in the URL. Alerts, notifiers and org members can be deleted with the same key" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 39.5 } ], "editorialScores": { "ergonomics": 64, "maintenance": 16, "payments": 40, "reliability": 40, "schema": 46, "security": 19, "transparency": 13 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "E", "kind": "listed", "method": "0.7", "score": 39.5 } ] }, "connect": { "install": "pip install shodan", "http": "curl \"https://api.shodan.io/shodan/host/8.8.8.8?minify=true\u0026key=$SHODAN_API_KEY\"" }, "letme": { "capability": "https://letme.dev/secintel.exposure", "tool": "https://letme.dev/shodan" }, "notable": [ "The API reference documents 37 paths and 44 operations at api.shodan.io for host lookups, search, counts, facets, on-demand scans, network alerts, notifiers, saved queries, bulk datasets, organisation members, DNS and account info, each with example requests and responses (https://developer.shodan.io/api)", "OpenAPI 3.0.0 document titled Shodan REST API Documentation 1.0.0, with a description on every operation, no securitySchemes block, no enums and a 404 response defined only on /shodan/host/{ip} (https://developer.shodan.io/api/openapi.json)", "All API plans are limited to 1 request a second, per the billing page. The official Python client throttles itself to that rate and retries a timed-out search cursor up to five times (https://account.shodan.io/billing)", "Host lookups through the REST API need at least a Membership; the help centre points free users to InternetDB, which answers without a key for non-commercial use and is refreshed weekly (https://help.shodan.io/developer-fundamentals/looking-up-ip-info)", "The Streaming API at stream.shodan.io and the Trends API at trends.shodan.io are labelled Enterprise in the reference, and Freelancer and higher plans get basic Streaming API access per the billing page (https://developer.shodan.io/api/stream)", "The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period or subprocessor, and says Shodan may share information with advertisers, business partners and sponsors (https://account.shodan.io/privacy)", "The official Python library `shodan` 1.31.0 was published on 17 December 2023 and the repository's last push was 5 August 2024, with 63 open issues and no CI configuration (https://pypi.org/rss/project/shodan/releases.xml)", "The status page at status.shodan.io is an UptimeRobot page whose component list failed to load for us and which shows only the last 7 days of updates (https://status.shodan.io/)" ], "area": "developer", "details": [ { "label": "Surface listed", "value": "The REST API at api.shodan.io, read from developer.shodan.io (reference, OpenAPI document, client list, Streaming and Trends pages), account.shodan.io (billing, privacy), help.shodan.io, status.shodan.io, internetdb.shodan.io, cvedb.shodan.io, the blog, PyPI and a clone of achillean/shodan-python on 3 November 2026. No account was made and no keyed call was sent" }, { "label": "Endpoints", "value": "37 paths, 44 operations. Search (host, count, search, facets, filters, tokens), scanning (ports, protocols, scan, scan/internet, scans), network alerts and triggers, notifiers, saved query directory, bulk data (Enterprise), organisation (Enterprise), account profile, DNS (domain, resolve, reverse), tools (httpheaders, myip) and api-info" }, { "label": "Credits", "value": "1 query credit per 100 results of a filtered search or any page after the first; counts and page 1 of an unfiltered search are free. 1 scan credit per IP scanned. Both reset monthly. DNS domain lookups cost 1 query credit. Export credits are deprecated and no longer sold" }, { "label": "Rate limits", "value": "1 request a second on all API plans, per the billing page. Corporate plans may look up 100 IPs in one request. Rescanning an IP within 24 hours needs Enterprise" }, { "label": "Response size", "value": "`minify` on host lookups returns ports and host facts without banners. On search, `minify` is on by default and truncates fields such as http.html, and `fields` selects which fields come back. Pages hold 100 results" }, { "label": "Errors", "value": "A non-200 status with a JSON body such as `{\"error\": \"Invalid IP\"}`. No error reference, 429 guidance or Retry-After documented" }, { "label": "Other APIs", "value": "Streaming API at stream.shodan.io (banners firehose, by ASN, country, port or CVE; Enterprise, with basic access on Freelancer and above). Trends API at trends.shodan.io (Enterprise). InternetDB and CVEDB are keyless and free for non-commercial use; commercial use needs an enterprise licence" }, { "label": "Client libraries", "value": "The Python library `shodan` (MIT, includes the `shodan` CLI) is the only one marked official. The clients page lists community libraries for Ruby, PHP, C++, C#, Crystal, Go, Haskell, Java, Node.js, Perl, PowerShell and Rust" }, { "label": "Legal entity", "value": "No company name on any page read. The footer says Shodan, all rights reserved. RDAP shows shodan.io registered on 22 August 2012 with John Matherly as the registrant organisation. The terms page was not read" }, { "label": "Status page", "value": "status.shodan.io, an UptimeRobot page. On 3 November 2026 its component list failed to load and it showed no updates in the last 7 days. No longer history was readable" } ], "unitPrices": [ { "item": "Membership (one-time, 100 query and 100 scan credits a month)", "unit": "month", "usd": 49, "note": "$49 paid once, lifetime" }, { "item": "Freelancer (10,000 query credits, 5,120 scan credits)", "unit": "month", "usd": 69 }, { "item": "Small Business (200,000 query credits, 65,536 scan credits)", "unit": "month", "usd": 359 }, { "item": "Corporate (unlimited query credits, 327,680 scan credits)", "unit": "month", "usd": 1099 } ], "provenance": { "legalEntity": "Shodan (no company name on its pages; shodan.io is registered to John Matherly)", "domain": "shodan.io", "domainRegistered": "2012-08-22", "endpointOnVendorDomain": true, "terms": "https://static.shodan.io/legal/terms.html", "privacy": "https://account.shodan.io/privacy", "statusPage": "https://status.shodan.io", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "No legal entity is named on www.shodan.io, developer.shodan.io, enterprise.shodan.io or the privacy policy. RDAP at the .io registry gives a creation date of 22 August 2012, registrar Gandi SAS and John Matherly as the registrant organisation.", "The terms of service URL comes from a search result. static.shodan.io answers 403 to robots.txt, so the terms were not fetched and nothing in the listing rests on them.", "www.shodan.io/robots.txt disallows /domain/ for all crawlers with a crawl delay of 10 seconds. developer.shodan.io, account.shodan.io and help.shodan.io have no robots.txt (404). blog.shodan.io disallows only /ghost/.", "The privacy policy is undated, names no entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties.", "/.well-known/security.txt returns 404 on www.shodan.io. No bug bounty, SOC 2 or ISO 27001 found on the pages read.", "No API changelog found. blog.shodan.io is the only dated record of changes, and its newest post is 7 August 2024." ], "score": 74, "checks": [ { "check": "Legal entity named", "value": "Shodan (no company name on its pages; shodan.io is registered to John Matherly)", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "shodan.io, registered 2012-08-22 (14 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.shodan.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 4.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 3 of the 8 things a reader expects", "points": 6.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.shodan.io", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://static.shodan.io/legal/terms.html", "state": "read", "readAt": "2026-11-03", "words": 4133, "points": 4.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The Terms, and your relationship with SHODAN under the Terms, shall be governed by the laws of the State of California without regard to its conflict of laws provisions.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Accordingly, only the limitations which are lawful in your jurisdiction will apply to you and our liability will be limited to the maximum extent permitted by law." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "SHODAN may at any time, terminate its legal agreement with you if: (A) you have breached any provision of the Terms (or have acted in manner which clearly shows that you do not intend to, or are unable to comply with the provisions of the Terms);" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "You agree that SHODAN may provide you with notices, including those regarding changes to the Terms, by email, regular mail, or postings on the Services.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You may not use the Services if you do not accept the Terms." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "You specifically agree not to access (or attempt to access) any of the Services through any automated means (including the use of scripts or web crawlers) and shall ensure that you comply with the instructions set out in any robots.txt file present on the Services.", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "You acknowledge and agree that the form and nature of the Services which SHODAN provides may change from time to time without prior notice to you.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "As part of this continuing innovation, you acknowledge and agree that SHODAN may stop (permanently or temporarily) providing the Services (or any features within the Services) to you or to users generally at SHODAN's sole discretion, without prior notice to you." } ], "notes": [ { "date": "2026-11-03", "text": "Content submitted through the service is licensed to Shodan perpetually and irrevocably, and the licence lets Shodan pass it to syndication partners.", "quote": "By submitting, posting or displaying the content you give SHODAN a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display" }, { "date": "2026-11-03", "text": "A late payment ends the term and revokes access to the products.", "quote": "Any late payment shall result in the termination of the Term and access to the Shodan Products shall be revoked." }, { "date": "2026-11-03", "text": "Materials that include Shodan information must attribute the use to Shodan and show its ownership and copyright.", "quote": "You acknowledge and agree that in the event any Shodan information or materials are included with any of Your materials, You must attribute such usage to Shodan." } ] }, { "kind": "privacy", "url": "https://account.shodan.io/privacy", "state": "read", "readAt": "2026-11-03", "words": 641, "points": 6.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "When we do, we will post those changes on this page so that you are always aware of the information we collect, how we use it, and under what circumstances we disclose it." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Individually identifiable information about you is not willfully disclosed to any third party without first receiving your permission, as explained in this privacy policy (\"Privacy Policy\")." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Feel free to contact us any time and we'll answer any additional questions you may have." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ] } ] }, "humans": { "slug": "shodan", "checked": "2026-11-03", "company": "Shodan", "people": [ { "name": "John Matherly", "role": "Founder", "founder": true, "x": "https://x.com/achillean", "github": "https://github.com/achillean", "bio": "John Matherly founded Shodan, the search engine for internet-connected devices, and unveiled it in 2009. His author page says he was born in Switzerland, moved to San Diego at 17, worked at the San Diego Supercomputer Center and studied bioinformatics at UC San Diego before building Shodan. He writes the Shodan blog and maintains the official Python library, whose licence carries his name.", "bioSources": [ "https://leanpub.com/u/shodan", "https://blog.shodan.io/", "https://github.com/achillean/shodan-python" ], "page": "/people/john-matherly/" } ], "peopleNote": "No page on www.shodan.io, developer.shodan.io, enterprise.shodan.io or help.shodan.io names a person, a team or a company; /about/the-team answers 404. John Matherly's own Leanpub author page (read 3 November 2026) calls him the founder of Shodan and links his X and GitHub accounts, the GitHub user record gives his company as Shodan and his location as Austin, Texas, RDAP gives him as the registrant of shodan.io, and the Python library's licence and PyPI metadata name him. No LinkedIn profile was linked from a first-hand page, so none is listed. Investors were looked for on the home page, the enterprise page, the blog's front page, the help centre and the privacy policy, and in two web searches on the founder and the company's funding; nothing names a company, a round or a backer, so ownership is recorded as unknown and no investors are listed.", "companySocial": { "linkedin": "https://www.linkedin.com/company/shodan", "x": "https://x.com/shodanhq" }, "support": { "emails": [ "support@shodan.io" ], "urls": [ "https://help.shodan.io/" ], "community": [ { "label": "Mastodon", "url": "https://mastodon.shodan.io/@shodan", "kind": "link" }, { "label": "Python library issues", "url": "https://github.com/achillean/shodan-python/issues", "kind": "github" } ], "contactEmails": [ "support@shodan.io", "sales@shodan.io" ] }, "sources": [ "https://leanpub.com/u/shodan", "https://api.github.com/users/achillean", "https://github.com/achillean/shodan-python", "https://blog.shodan.io/", "https://www.shodan.io/", "https://developer.shodan.io/", "https://enterprise.shodan.io/", "https://help.shodan.io/", "https://rdap.identitydigital.services/rdap/domain/shodan.io" ], "ownership": { "status": "unknown", "checked": "2026-11-03", "sources": [ "https://www.shodan.io/", "https://enterprise.shodan.io/", "https://rdap.identitydigital.services/rdap/domain/shodan.io" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shodan.json", "live": { "slug": "shodan", "probe": { "target": "https://api.shodan.io", "method": "get", "lastAt": "2026-11-04T19:35:09.376972826Z", "lastOk": true, "lastStatus": 404, "lastMs": 372, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 235, "p95ms24h": 372, "samples24h": 43, "samples30d": 43, "days": [ { "date": "2026-11-04", "probes": 43, "ok": 43 } ] }, "vendorStatus": { "page": "https://status.shodan.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:35.193047696Z" }, "securityTxt": { "url": "https://shodan.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:49.622046628Z" }, "updatedAt": "2026-11-04T19:35:09.376972826Z" } } }